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(g) Method of remote diagnostics for franking machines. 



i A franking machine system is disclosed in 
which each franking machine (10,-10,,) includes 
a fault history memory (22) into which fault 
codes are written as each fault occurs. Period- 
ically the accumulated fault codes in the mem- 
ory (22) are read out and transmitted to a 
remote central fault analysis computer (24) to 
generate a prediction of faults likely to occur in 
each franking machine. Where the franking 
machines (10 r 10 n ) periodically communicate 
with a remote re-setting computer (20) for re- 
setting credit in the franking machines, the 
re-setting computer (20) includes storage 
means (23) to store the fault histories from each 
of the franking machines and each credit re- 
setting operation with a franking machine in- 
cludes transmission to the re-setting computer 
and writing into the storage means thereof of 
the fault history of that franking machine. The 
fault analysis computer (24) periodically com- 
municates with the re-setting computer to re- 
ceive the fault histories stored therein of the 
franking machines. 
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This invention relates to remotely diagnosing 
faults which may occur in franking machines. 

Franking machines in use in the field may develop 
faults at indeterminate periods. Some faults may be 
insignificant and merely prevent use of certain facili- 
ties normally provided, by the machine or may be In-' 
termittent and affect use of the franking machine at in- 
determinate times.- Other more serious faults may oc- 
cur which result in inhibition of use of the machine for 
franking of mail items.- The latter more serious faults 
cause significant inconvenience to the user of the ma- 
chine because the machine is not available for use in 
franking mail. It is desirable to reduce or prevent the 
occurrence of faults, in machines in order to ensure 
that generally the machines are always available for 
use when required. By maintaining a fault history of 
each machine in the field it is possible from analysis 
of the fault history of any individual machine to predict 
and provide an early warning of the possible occur- 
rence of a specific fault From this predictive informa- 
tion action may be taken to service or modify the 
franking machine prior to the occurrence of the pre- 
dicted fault and thereby prevent loss of use of the ma- 
chine. 

According to the invention a method of remotely 
diagnosing faults which may occur in a franking ma- 
chine comprises the steps of storing in a memory of 
the franking machine a fault code identifying a fault in 
the franking machine upon occurrence of the fault to 
form a fault history of the franking machine; periodi- 
cally accessing said memory to read said fault history 
comprising codes stored in said memory subsequent 
to a previous access; transmitting said fault history 
read from the memory to a central computer; and ana- 
lysing said fault history to provide an indication of im- 
pending faults. 

The invention also envisages apparatus for car- 
rying out the method. 

The method in accordance with the invention will 
now be described by way of example with reference 
to the drawings inwhich:- ■ ^ 

Figure 1 is a block diagram illustrating franking 

machines connected for communication with a re- : 
. mote resetting centre and service centre, and 

Figure 2 is a flow chart of a sequences of events 
. in remote fault diagnosis and remedial action in> 

respect of a franking machine. 

Referring first to Figure 1 , a franking machine 1 0 U 
comprises an electronic microprocessor 1 1 for carry- 
ing out control and accounting functions in the frank- 
ing machine. A keyboard 12 is provided for input of 
data by a user of the machine and a display device A 3 
is provided to enable the microprocessor to display in- 
formation to assist the user in using the franking ma-, 
chine. A read-only memory (ROM) 14 is provided for, 
the storage of fixed information such as program rou-. 
tines for controlling operation of the microprocessor 
1 1 and a random access memory 15 is provided as a 



working store for the microprocessor. Non-volatile 
memories 16, 17 are provided for the storage of ac- 
counting data and as is well known in franking ma- 
chines may include a descending register for storing 

5 a value of credit available for use in franking of mail 
items with postage value, a tote register for storing an 
accumulated value of postage used in franking mail 
items, an , items register storing a count of the number 
of items franked and a high items register for storing 

10 a count of the number of items franked with a postage 
value in excess of a predetermined value. A printing 
device 18 is controlled by the microprocessor to print 
franking impressions on mail items. In franking ma- 
chines which operate in a pre-payment mode, the 

15 user of the machine makes a payment to the postal 
authority and the value of the payment is entered into 
the descending register of the franking machine to 
provide an amount of credit available for use in frank- 
ing mail items with postage value. The read-only 

20 memory 14 stores a program routine for controlling 
the microprocessor in carrying out franking opera- 
tions. In such franking operations, the user of the ma- 
chine inputs by means of the keyboard 12 a value of 
postage with which a mail item is to be franked and the 

25 microprocessor checks to determine that there is a 
sufficient value of credit in the descending register for 
required franking. If there is sufficient credit the micro- 
processor continues with the program routine to mod- 
ify the contents of the registers to take account of the 

30 franking being effected and to operate the printing de- 
vice to print a franking impression with the required 
postage value on the mail item. If there is insufficient 
credit available the franking routine. is terminated and 
printing of the franking impression Is not effected. The 

35 franking machine remains incapable of carrying out 
further franking operations until such time as addition- 
al credit has been entered into the descending regis- 
ter. 

As is well known in franking machines those op- 

40 erational parts of the machine which maintain ac- 
counting records and which effect printing of the 
franking impression are protected from attempts to 
fraudulently interfere with the operation thereof. To 
this end the operational parts of the machine are 

45. housed in a secure housing access to which may be 
made only.by authorised personnel of the postal au- 
thority or of an authorised service organisation and - 
any external electrical connections to the machine are 
protected to prevent external application of unautho- 

5o>. rised signals in an attempt to use the machine fraudu- 
lently. The accounting operations and storing of the 
accounting records are carried out in a manner to en- 
sure integrity of the accounting data even in the event 
of the occurrence of faults in the machine. For exam- 

55.. pie, each register is duplicated in each of the non-vol- 
atile memory devices 16, 17 so that if one device 
should fail, the registers in the other device will con- 
tinue to store the accounting data. 
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The franking machine is provided with an in- 
put/output interface 19 communicating with the micro- 
processor to enable the microprocessor to communi- 
cate with apparatus external to the franking machine. 

Previously, when the credit value in the descend- 
ing register had fallen to a low value it was necessary 
for the postage meter of the franking machine to be 
taken to a resetting authority such as the postal au- 
thority to have an increased value of credit 1 entered 
into the descending register. However current post- 
age meters are constructed to have provision to en- 
able increased credit to be entered remotely without 
removing the postage meter from the user's premises. 
A system for re-setting credit in a franking machine re 1 
motely by means of a re-crediting computer 20 is de- 
scribed in our european patent application 
89313220.9. Communication is established between 
the microprocessor of the franking machine and a re- 
crediting authority computer 20 via the interface 19 
and a telephone network 21 . The microprocessor 1 1 
and the computer 20 carry out a series of steps in 
which credit update information is transmitted from 
the computer to the franking machine and in which the 
franking machine sends accounting data from its reg- 
isters to the computer. Security in transmission of the 
information over open telephone lines is maintained 
by transmitting a transaction identity code comprising 
a pseudo-random number in messages between the 
computer and franking machine and by encrypting the 
messages. 

During operation of franking machines faults may 
occur which in themselves do not prevent operation of 
the machine for franking purposes but which may pro- 
vide an indication that a more serious fault condition 
preventing use of the machine has a probability of oc- 
curring in the future. Accordingly it is desirable to log 
faults as they occur in each machine to provide a fault 
history for each individual franking machine and to 
analyse these faults to determine if from experience 
any of the machines in use in the field have a fault his- 
tory which suggests that they are likely to fail in oper- 
ation. The' franking machine 10i is provided ■ with a- 
fault register 22 having a number "n* of storage loca- 
tions. Upon occurrence of a fault; the microprocessor 
writes a code representing the type of fault which has 
occurred into a storage location of the fault register^' 
the codes being written into the storage locations in 
turn. Thus at any time, the register stores a log of the 
most recent "n* faults which have occurred. The pro 1 
gram routine carried out by the franking machine dur- 
ing resetting of credit includes a sub-routine in which 
the contents of all the storage locations' of the fault 
register 22 are read out and transmitted to the re-cred- 
iting authority computer 20. The storage locations' of 
the fault register are erased so that after read out, the 
register is ready to receive the code representing the 
next fault when it occurs. Instead of erasing the stor- 
age locations of the fault register, the storage loca- 



tions may be overwritten in turn in such a manner that 
when the code for each new fault is written to the reg- 
ister the code for the oldest fault is overwritten. Ac- 
cordingly the codes stored in the register always rep- 

5 resent the most recent "n" faults which have occurred. 
The re-crediting authority computer is provided with 
memory 23 and when the computer receives the log 
of fault codes from a franking machine in the course 
of re-setting credit in that franking machine, the com- 

10 puter writes the log of fault codes into its the memory 
23. It will be appreciated that a large number of frank- 
ing machines 10i - 10 n are re-credited as and when 
required by a single central re-crediting computer. Ac- 
cordingly the log of fault codes is stored in the memory 

15 together with information identifying the meter from 
which the log has been received. Thus over a period 
of time, the computer 20 will receive and store in 
memory 23 the fault logs or histories of all those ma- 
chines 10 1 - 1 0 n which have had credit updated during 

20 that period. It will be appreciated that this transmis- 
sion of fault data occurs automatically each time a 
franking machine is re-credited and hence as result 
does not require communication with the franking ma- 
chine specifically for the purpose of transmitting fault 

25 data. Accordingly the user of the machine is not re- 
quired to carry out any additional operation and the 
accumulation and transmission of fault data is trans- 
parent to the user. Furthermore by transmitting the 
fault log data as part of the re-crediting routine, the 

30 data is transmitted and collected at the computer 
memory 23 at a periodicity which corresponds to 
some extent upon the amount of use of each franking 
machine. In Figure 1 , the fault register 22 is shown as 
a separate element however if desired the fault regis- 

35 ter may be implemented as a register in the non-vol- 
atile memories 16, 17 and like the accounting regis- 
ters in these memories may be duplicated in each of 
the memories 16 and 17. 

Servicing and correcting faults in franking ma- 

40 chines is carried out by an authorised service organ- 
isation. The service organisation is provided with a 
computer 24 which is capable of communicating with 
the re-crediting authority computer 20 and is permit- 
ted to have access to the fault log data in memory 23. 

45 Periodically the computer 24 accesses the fault log in 
memory 23 and an analysis of the faults which have 
occurred on the franking machines is carried out. 
Such an analysis may predict that a specific franking 
machine is likely to develop a specific fault and in ac- 

50 cordance with that prediction a service engineer visits 
the site of the franking machine to carry out modifica- 
tion or repair of the machine to prevent occurrence of 
the predicted fault. The analysis alternatively may 
predict that a specific batch of machines is prone to 

55 one or more specific faults in which event action may 
be taken to modify all machines in that batch to pre- 
vent occurrence of that fault in those machines of the 
batch which are not yet affected. 
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Where the re-crediting of franking machines is 
carried out by means of transportable memory mod- 
ules as in the CREDIPAC re-crediting system market- 
ed by Alcatel Business Systems Limited, the trans- 
portable modules may be utilised to convey fault log 
data from the franking machine to the computer 20 in- 
stead of. utilising the telephone network. For a more 
detailed description of . the operation of re-crediting 
utilising a transportable memory module reference 
may be made to the specification of our British patent 
No. 2173738. 

As hereinbefore described, transmission of the 
fault log data from the franking machine is effected 
each time the franking machine is re-credited. How- 
ever transmission of the fault log data may be effected 
as part of another routine which occurs periodically for 
each machine. For example, franking machines which 
are operated in a post payment mode do not carry out 
re-crediting operations. However periodically the 
postal authority require to receive data relating to us- 
age of the machines and for this purpose receive the 
values stored in the accounting data registers to en- 
able the authority to audit usage of the machines. 
Where the data relating to usage of the machines col- 
lected remotely by transmission of the data either by 
means of the telephone network or for example by 
means of a transportable module the transmission of 
fault log data may be effected as a sub-routine of the 
main routine for collection of account data. 

The flow chart of Figure 2 illustrates the steps car- 
ried out in each of the franking machines 10, - 10 n , the 
central re-crediting computer 20 and the service com- 
puter 24 to. provide fault histories of each machine, to 
transmit these fault histories to the service computer 
and to modify or repair the machines in dependence 
upon analysis of the fault histories. 

Analysis of the fault log of a specific franking ma- 
chine may indicate that there is a probability of failure 
of a component of that machine which would result in 
the machine becoming inoperable to effect franking of 
mail items and hence require an on-site visit by a ser- 
vice engineer to effect an early repair or replacement 
of that component to ensure that the machine contin- 
ues to operate satisfactorily and remains in service. 
However the analysis of the fault log may indicate a 
fault history which does not require physical replace- 
ment or repair of a component For example faults 
may arise from software program routines or sub-rou- 
tines particularly under certain conditions of use of the 
machine in which there is interaction between sub- 
routines which had not been envisaged when the soft- 
ware.was written or installed in the machine. Such 
faults may also arise due to change in tolerances of 
electronic components such that they are required by 
a software routine to operate close to a current toler- 
ance limit. A modification of the software routine. may 
be made which has the effect of operating the compo- 
nent safely within its current tolerance. In response to 



such faults being registered in any of the franking ma- 
chines, transmitted to the re-credit computer 20, and 
written to the memory 23 and then being transferred 
to the service computer for analysis, the software may 

5 be modified to overcome any tendency for the detect- 
ed fault to occur. Instead of installing the modified 
software by on-site visits of a. service engineer, the 
service computer 24 may communicate via the tele- 
phone network 21 with a selected one of the franking 

10 machines 10, - 10 n to enable the modified software 
code to be transmitted to the franking machines from 
the service computer via the telephone network. The 
modified software code may be transmitted to all 
franking machines of a specified model number in the 

15 field or only to those franking machines which, from 
analysis of their fault histories, indicate a need for 
modification of the software. Access to the memories 
in the franking machines which store software code 
must be restricted to prevent unauthorised modifica- 

20 tion of the software and accordingly any transmission 
from the service computer to the franking machines 
for the purpose of modifying or writing new software 
routines into the memories of the franking machines 
includes signals which enable access to the software 

25 code memories to be obtained. Such transmissions 
are carried out in a secure manner to ensure that only 
authorised transmissions enable access to the soft- 
ware code memories and that only the software code 
transmitted in an authorised transmission is written to 

30 the memories of the franking machines. A method of 
securely transmitting data over a telephone network 
for the purpose of re-crediting a franking machine is 
described in our European patent application 
8931 3220.9 referred to hereinbefore. A similar secure 

35 method of transmitting data may be used for transmis- 
sion of signals to modify operation of the franking ma- 
chine. Where re-crediting is effected by means of a 
transportable memory module as described in our 
British patent No. 2173738 and referred to hereinbe- 

40 fore modification of software code in a franking ma- 
chine may be effected by utilising the transportable 
memory module to carry the modified software code 
to be written into the memory of the franking machine. 
Our British patent describes a method of ensuring se- 

45 curity of the data carried by the module and such a 
method may be utilised to ensure security of signals 
carried by the module to be utilised to modify opera- 
tion of the franking machine. 

The modification of software may include re-con- 

50 figuration of variables capable of being set in the 
franking machine software program routine. The soft; 
ware memories of the franking machine may be load- 
ed with a number of subroutines in manufacture of the 
franking machine. Some of these sub-routines may 

55 be activated upon installation of the franking machine 
while others of these sub-routines are left in-activat- 
ed. During use of the franking machine in the field it 
may be desired to de-activate or activate selected 
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ones of these coresident sub-routines either to mod- 
ify the facilities provided by the franking machine or in- 
order to overcome the probability of a fault arising as 
indicated by the analysis of the fault history of thatma- 
chine. 1 

When faults occur in the franking machine, fault 
flags are set to indicate the occurrence of the fault. 
Some faults may arise due to a detected error in data 
stored in the franking machine. Electronic accounting 
data is handled by the circuits of the franking machine 
in a manner such that, except in the event of catastro- 
phic failure, the data can be re-constructed. For ex- 
ample each register which stores accounting data is 
replicated four times and in each operation of the 
franking machine involving the accounting data the 
contents of the four replications of the registers are 
compared. If the contents are identical continued op- 
eration of the franking machine is permitted. However 
if the contents of three replications of the register are 
the same but one register is different a fault flag is set 
to inhibit continued operation of the machine. Since 
the contents of three replications of the register are 
identical it is clear that these replications contain cor- 
rect data. Accordingly a sub-routine can be activated 
to correct the data in that one of the replications which 
is different from the other three replications and to re- 
set the fault flag. This subroutine may be activated re- 
motely by the service computer using a secure trans- 
mission and then the fault flag may be reset remotely 
by a secure transmission. If the data has been correct- 
ed the fault flag can be reset. Other faults may occur 
which do not involve electronic data. If the fault is tran- 
sitory or intermittent a transmission to reset the fault 
flag will be successful in resetting the fault flag. How- 
ever where a permanent or non-transitory fault exists 
the reset of the fault flag will fail. Many faults are tran- 
sitory or intermittent and hence the remote resetting 
of the fault flag allows the franking machine to be con- 
tinued to be used until a service repair can be effect- 
ed. ' 

In Figure 1, the service computer 24 is shown as 
communicating with the re-credit computer by means 
of a dedicated communication link 25. However it is to 
be understood that the service computer may commu- 
nicate with the re-credit computer via the telephone 
network 21. 



said memory subsequent to a previous access; 
transmitting said fault history read from the mem- 
ory (22) to a central computer (24); and analysing 
said fault history to provide an indication of im- 
5 pending faults. 

2. A - method of remotely diagnosing faults" as 
claimed In claim 1 further characterised in that the 
franking machine (100 is in communication from 

w time to time with a central re-crediting computer 

(20) for updating of credit stored in the franking 
machine and in that said memory (22) in the frank- 
ing machine is accessed and the fault history stor- 
ed therein is transmitted to the central re-crediting 

15 computer (20) each time the franking machine is 

in communication with the central re-crediting 
computer for re-setting of the credit stored in the 
franking machine. 

20 3. A method as claimed in claim 2 further character- 
ised by the step of storing at the central re-cred- 
iting computer (20) the fault history received from 
each of a plurality of franking machines (10,-10,,) 
as the respective franking machines are re-cred- 

25 ' ited by the re-crediting computer (20). 

4. A method as claimed in claim 3 including the step 
of periodically accessing the fault histories stored 
by the central re- crediting computer (20) and 

30 transmitting said fault histories to a fault analysis 

computer (24). 

5. A method as claimed in any preceding claim fur- 
ther characterised in that the fault history is trans- 

35 mitted from the franking machine (10,-1 0 n ) to the 

central computer (24) via an input/output inter- 
face (1 9) of the franking machine and a telephone 
network (21). 

40 6. A method as claimed in any one of claims 1 to 4 
further characterised in that the fault history is 
- transmitted from the franking machine to the cen- 
tral computer (24) by writing said fault history into 
a transportable memory module; connecting said 

45 module to the central computer (20) and reading 

the fault history from the module to the computer. 



Claims 

1. A 1 method of remotely diagnosing faults Which 
' may occur in a franking machine characterised by 
' the steps of storing in a memory (22) of the frank- 
ing machine (10,) a fault code identifying a fault 
in the franking machine upon occurrence of the 
fault to form a fault history of the franking ma-* 
chine; periodically accessing said memory to 
read said fault history comprising codes stored in 



so 
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7. A method as claimed in any preceding claim fur- 
■ ther characterised by means (24) responsive to 

the fault history received by the Central computer 
and operable to communicate with at least one 
selected franking machine (10,-10,,) to effect 
"-■« modification of operation of that franking ma- 
chine. 

8. A method as claimed in claim 7 further character- 
'* ised in that the means (24) responsive to the fault 
' history is operable in response to the fault history 
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to transmit a signal to the selected franking ma- 
chine effective to modify a program routine or 
sub-routine in said franking machine. 

9. A method as claimed in claim 8 further character- 5 
ised in that the modification of the program rou- 
tine comprises activating or de-activating pro- 
gram sub-routines which are co-resident in the 
selected franking machine. 

10 

10. A method as claimed in claim 7 or 8 wherein the 
means (24) responsive to the fault history is op- 
erable to transmit a reset signal to the selected 
franking machine effective to reset a fault flag in 
said franking machine. is 

1 1 . A method as claimed in any one of claims 7 to 1 0 
further characterised in that the transmission of 
signals to modify operation of a selected franking 
machine is effected in a secure manner. . 20 

12. A franking machine system characterised by a 
franking machine (100 including a fault history 
, memory (22); means (1 1) operative upon occur- 
rence of a fault in said franking machine to write 25 
into said- memory (22) a fault code representing 

said fault, to form in said memory a fault history 
comprising a series of fault codes representing 
respectively a series of occurred faults; 
a central computer (24) remote from said franking 30 
machine; communication means (21) for trans- 
mitting data between said franking machine and 
said central computer; 

means (11) operative periodically to read said 
fault history comprising the series of fault codes 35 
from said memory (22) and to transmit said fault 
history via said communication means (21) to 
said central computer (24); and 
said central computer (24) being operative in re- 
sponse to said fault history to analyse said fault 40 
history and generate an indication of impending 
faults of said franking machine (10,). 

13. A franking machine system characterised by a 
central re-crediting computer (20) including fault 45 
storage means (23); a plurality of franking ma- 
chines (lO^IOn) ; each said franking machine in- 
cluding accounting registers (16, 17) for storing 
accounting data; a fault history memory (22); 
means (11) operative upon occurrence of a fault so 
in said franking machine to write into said memory 

(22) a fault code representing the fault which has 
occurred so that the memory (22) stores a fault 
history comprising a series of faults codes repre-^ 
senting a series of occurred faults; cbmmunica- 55 
tion means (21) operable to transmit data be- 
tween said central computer (20) and each of said 
franking machines; 



A2 10 

means operable to exchange data between the 
central computer (20) and a selected one of said 
franking machines (10i-10 n ), said data including 
re-crediting data effective to re-credit said ac- 
counting registers (1 6. 1 7) of said selected frank- 
ing machine and to read out from said fault history 
memory (22) of said selected franking machine 

. said, fault history stored therein and to transmit 
said fault history to said central computer (20) for 
storage in said fault storage means (23); and 
a fault analysis computer (24) operable periodi- 
cally to communicate with said re-setting comput- 

. er (20) to read out fault histories stored in said 
fault storage means (23) relating to franking ma- 
chines of said plurality and to analyse said fault 
histories and to generate for each franking ma- 
chine an indication of impending faults. 
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